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Intro on ETSI 

□ A European standards organization, 
created in 1988, active in all areas of telecommunications 

> including radio communications, broadcasting and 
Information Technology 

□ Supporting EU and EFTA regulation and initiatives 

□ Favours international collaboration 

□ A not-for-profit organization 

□ Members: Administrations, Administration Bodies and NSOs 
Network Operators, Service Providers, Manufacturers, Users 

□ Creates different deliverables to meet market needs 

□ All publications freely available! Downloadable from ETSI Website 

http://pda.etsi.org/pda/queryform.asp 

http://portal.etsi.org 
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ETSI C 



ETSI Members per country (March 2008) 
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3 


Hungary 


6 


Qatar 


1 


Austria 
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Taiwan 
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Lichtenstein 
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Turkey 
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Estonia 
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Ukraine 
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15 
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United Arab Emirates 
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France 


71 
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United States 


65 
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1 


Malta 


2 


Uzbekistan 


1 
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1 


Netherlands 


29 


Yemen 


1 


Germany 


90 


Norway 


8 


62 countries 


707 
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Global Standards Collaboration 

Interregional collaboration on selected 
standardization subjects between partners 
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(Japan) 
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Partnership Project 

3 rd Generation Partnership Project 

specifying a W-CDMA system based on 
an evolution of the GSM core network, a 
member of the ITU’s IMT-2000 family 

A GLOBAL INITIATIVt 

http ://www. 3gpp. org 




Organizational Partners: 

ETSI (Europe) CCSA (China) ARIB (Japan) 
ATIS (USA) TTA (Korea) TTC (Japan) 
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Main body in ETSI for 

Lawful Interception Standards development 

and 

Retained Data handover Standardisation is 

ETSI/TC LI 

Technical Committee on Lawful Interception 
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Intro on ETSI/TC LI 




□ Created as stand-alone TC in October 2002 

□ Meetings 

> Three plenary meetings a year are organised 
(35-84 participants) 

> Dedicated Rapporteur’s meetings can be organised on a specific issue 

□ The meetings can be attended by ETSI members 

> Non-ETSI members can participate by invitation of the chairman 

> Next meeting: ETSI/TC Ll#21, 29 June - 1 July 2009 

□ Dedicated TC LI e-mail server and document server 

> Open to all (registered) ETSI members 

□ Producing reports and specifications 

> On Lawful Interception and Retained Data 

> Mainly on the Handover Interface 

□ Promoting globally ETSI Lawful Interception and Data Retention 
standards amongst operators and national bodies 

» : 
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Delivarables of ETSI/TC LI 




□ ETSI/Technical Committee Security (TC SEC) 

> Working Group Lawful Interception (SEC-WGLI) (1997) 

> on LI: TR 102 053 vl. 1.1 ES 201 158 v 1.2.1 



□ ETSI/Technical Committee Lawful Interception (TC LI) 



> 

> 

> 

> 

> 

> 

> 

> 

> 

> 



Established as stand-alone TC in October 2002 



on Lawful Interception: 



TR 101 943 V2.2.1 
TR 102 528 vl. 1.1 
TS 101331 vl.2.1 
TS 102232-1 V2.4.1 
TS 102 232-4 V2.1.1 
TS 102232-7 V2.1.1 



TR 102 503 vl. 4.1 

TS 101 671 V3.4.1 
TS 102 232-2 V2.3.1 
TS 102232-5 V2.3.1 

TS 102 656 vl.2.1 



on Data Retention: 

Security Report on LI and DR: 



TR 102 519 vl.1.1 

ES201 671 V3.1.1 
TS 102 232-3 V2.2.1 
TS 102 232-6 V2.3.1 

TS 102 657 vl.2.1 
TR 102 661 vl.1.1 




Terms of Reference ETSI/TC LI 




□ To capture the requirements of “Law Enforcement Agencies” (on 
Lawful Interception and Data Retention) and translating those into 
requirements to be applied to Technical Specifications 

□ To develop and publish handover interfaces, and rules for the 
carriage of technology specific interception across these 
interfaces 

□ To develop a set of standards that allow ETSI standards to 
support industry compliance to the requirements of national and 
international law 
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Participation in ETSI/TC LI 

□ Law Enforcement Agencies / Governments organisations / 
Research organisations 

> NL, UK, DE, AS, S, GR, ES, FR, RU, FIN, IT, NO, CY, HU, UA 

> AU, CA, USA, KR 

□ Communication Service Providers 

> Vodafone, KPN (NL), BT (UK), DT (DE), TeliaSonera (S), Telstra (AU) 
Inmarsat, UPC, Telenor, RIM, Telecom Italia, T-Mobile, Swisscom 
Wind, TDC (DK) 

□ Manufacturers (switch / mediation / LEA equipment) 

> Nokia Siemens Networks, Siemens, Ericsson, Cisco, Alcatel-Lucent 
Pine Digital Security, Aqsacom, ETI, VeriSign, Nortel, GTEN, AREA 
Verint, Detica, Thales, NICE Systems, Utimaco Safeware, Iskratel 
ATIS Systems, SS8, Spectronic, Group 2000, ZTE, HP, IPS, Suntech 

Manufacturers may be active in more areas 
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Activities in ETSIVTC LI 

on 

Retained Data Handover Interface 
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15th of March 2006: the European Parliament 
and the Council of the European Union adopted 
Directive 2006/24/EC on Data Retention 




Data generated or processed in connection with the provision of 
publicly available electronic communications services 

or of 

public communications networks 
need to be retained 
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Applicability Directive 

□ The content of the communication is not part of the directive 

□ Data to be Retained 

> Successful and unsuccessful communication attempts 

> Wireline network telephony / Wireless network telephony 

> Internet access / Internet e-mail / Internet telephony 

□ Categories of data to be retained 

> data to trace and identify the source of a communication 

> data to identify the destination of a communication 

> data to identify the date, time and duration of a communication 

> data to identify the type of communication 

> data to identify users' communication equipment or what purports to 
be their equipment 

> data to identify the location of mobile communication equipment 

□ Proportional requirements shall be defined by each Member State 
in its national law 




» : 
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ETSI/TC LI 
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Why standardisation of RD handling 

□ Easier to define own storage and delivery mechanism 

> No need to define/invent complete own delivery / receiving system 

> National options are possible 

□ “Cheaper” products 

> Manufacturers need to develop one basic product 

> National options are additional 

□ Data Retention result is meeting international and national 
requirements 

□ RD Standards in ETSI are actively developed in good 
harmonization and are approved by all involved parties 

□ Common way for all involved parties 

□ Continuous increase in types of Retained Data 

> Use of the telecommunication 

> Number of different services used 

> Number of different access networks used 
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Functional Model 

Communication Service Provider 




Network 

elements 





Data 

Collection 

Function 



Administrative 

Function 



Data store 
Management 
Function 



Handover Interface Hl-A 



administrative 



Handover Interface Hl-B 



transmission RD 
material 



Authorised 

Organisation 



Issuing 

Authority 



Receiving 

Authority 



Hl-A: various kinds of administrative, request and response information from/to the 
Issuing Authority and the responsible organization at the CSP for RD matters. 
Hl-B: retained data information from the CSP to the Receiving Authority 
Hl-A and Hl-B may be crossing borders between countries: 

subject to corresponding national law and/or international agreements. 
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Retained Data Specifications in ETSI/TC LI 



□ ETSITS 102 656 (vl.2.1) 

Requirements of LEAs for handling Retained Data 

> guidance and requirements for the delivery and associated issues of 
retained data of telecommunications and subscribers 

> set of requirements relating to handover interfaces for retained traffic 
and subscriber data 

> requirements to support the implementation of Directive 2006/24/EC 

> freedom for national regulations, procedures and processes 

□ ETSI TS 102 657 (vl.2.1) 

Handover interface for the request and delivery of Retained Data 

> handover requirements and handover specification for the data that 
is identified in EU Directive 2006/24/EC on Retained Data and in 
national legislations as defined in TS 102 656 

> considers both the requesting of retained data and the delivery of the 
results 

> defines an electronic interface 



UtXfMigwt 
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T5 



CSP 



Retained Data Handover Signalling principle 

Successful delivery 



REQUEST: Request for Retained Data (Hl-A) 



REQUEST(ACK): Acknowledge request message (Hl-A) 



Response: Results of RD request (Hl-B) 



RESPONS(ACK): Acknowledge response message (Hl-A) 



□ Data exchange techniques 

> “direct TCP” with BER encoding derived from the ASN.1 

> “HTTP” with XML encoding 

• on top of the standard TCP/IP stack 

• choice of technique is a national option 

M 
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Modular approach RDHI specification 



Framework for Retained Data Handover Interface 
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services 


Asynchronous 

message 

services 


Synchronous 

Multi-media 

services 


Network 

Access 

services 




PSTN/ISDN 

GSM/UMTS-cs 

SMS 

A 


E-mail 

webmail 


chat 


Internet 

GPRS 

UMTS-ps 

/\ 





l»WStr«t*gwt 



ISSWorldfc^ Track 3-4 June 2009, Prague; ETSI/TC LI activities on Retained Data and Lawful Interception 



T5 



Schematic representation of top level ASN.1 



RetainedDataRecord 



telephonyRecord 



networkAccess 




naSubscriber 

naServicellsage 

naDevic 

e 

naNetworkElement 



messageRecord 

— msgSubscriber 
msgServicellsage 
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/]TelephonyRecord: Subscriber and Servicellsage 



t^lephonySubscriber 

subscriber! D_ 

[GENERIC SUBSCRIBERJNFOJ 
telepHonySuEscriberlnfo “* 
subscribedTelephonyServices 
SjubscribedTelephonyServices 
' servicelD 
' providerlD 
' timeSpan 
' registered Numbers 
registeredICCID 
serviceType 
' installationAddress 
connectionDate 
■ iMSI 

carrierPreselect 
' lineStatus 



tplephonyBillingDetails 

subscriberlD 
servicelD 
billingAddress 
billingldentifier 
billingRecords 
L BillingRecords 
' time 
' place 
' amount 
' currency 
' method 
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TelephonyRecord: ServiceUsage, Device and 

\SU NetworkElement 

- telephonyServiceUsage 



pjarty Information 
Party Information 
partyRole 
partyNumber 
subscriberlD 
devicelD 
locations 

communicationTime 
iCCID 
iMSI 

natureOfAddress 
forwardingTransferredNumber 
terminatingTransferredNumber 
communicationTime 
ejventlnformation 
Eventlnformation 
time 
type 
party 
location 
endReason 
communicationType 
bearerService 
smslnformation 



telephonyDevice 

— telephonyDevicelD 
I— devicelDType 

telephonyNetworkElement 

— telephonyNetworkID 
cell Information 
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ringingDuration 
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GenericSubscriberlnfo 

— organizationlnfo 

— name 

— contactDetails 

I— nationalRegistration 

— individuallnfo 

— name 

— contactAddress 

— date Of Birth 

— gender 

— identificationNumber 

— authenticationlnfo 
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Security Report 




□ ETSI TR 102 661 

Security framework in Lawful Interception and Retained Data 
environment 

> defining a security framework for securing Lawful Interception and 
Retained Data environment of the CSP and the Handover of the 
information 

> Advice on Security measurements 

> Advice on Physical security 



CSP= Communication Service Provider 
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What’s next? 




□ ETSI/TC LI is keeping a close working relation with the 
EC/Experts Group “The Platform on Electronic Data Retention for 
the Investigation, Detection and Prosecution of Serious Crime” 

□ ETSI/TC LI will maintain the Retained Data standards 

> Add synchronous multi-media services 

> Add new internet services as technology progress 

> Add new parameters in line with national requirements 

□ ETSI/TC LI can organise an interoperability test, if required 

> ETSI Plugtest for checking the specifications 

□ ETSI/TC LI is encouraging widespread use of the RD standards! 

> The use of the Handover standard is already promoted in 
international conferences and workshops 



UtXfMigwt 
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Details on ETSI 

Lawful Interception Standardisation 
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Why Lawful Interception implementation in EU 



17th January 1995: EU Council of Ministers 
adopted resolution COM 96/C329/01 on Lawful Interception 




The providers of public telecommunications networks and services 
are legally required to make available to the authorities the 
information necessary to enable them to investigate 

telecommunications 



M*Str4rt«p*t 
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Why standardisation of LI handling 

□ Easier to define own LI mechanism 

> Guidance is given for network architecture 

> No need to define/invent complete own LI system 

> National options are possible 

□ “Cheaper” LI products 

> Manufacturers need to develop one basic product 

> National options are additional 

□ Intercepted result is meeting international requirements by 
Law Enforcement Agencies 

□ LI Standards in ETSI/TC LI are actively developed in good 
harmonization and are approved by all involved parties 
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LEA requirements (step 1) 



□ ETSI TS 101 331 

Requirements of Law Enforcement Agencies 

> Provides guidance in the area of co-operation by network 
operators/service providers with the lawful interception of 
telecommunications 

> Provides a set of requirements relating to handover interfaces for the 
interception 



UtXfMigwt 

ISS World Euwf* Track 3-4 June 2009, Prague; ETSI/TC LI activities on Retained Data and Lawful Interception 




□ Intercept Related Information (IRI) 

> Collection of information or data associated with telecommunication 
services involving the target identity: 

• communication associated information or data 
(including unsuccessful communication attempts) 

• service associated information or data 

(e.g. service profile management by subscriber) 

• location information 



□ Content of Communication (CC) 

> Information exchanged between two or more users of a 
telecommunications service 
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□ Parties in the communications 

> Neither the target nor the other parties involved in the 
communications should be able to detect that interception is 
(de)activated or that interception is taking place 

□ Other users 

> Other users of any telecommunications service should not be able, 
by any means, to detect that any interception facility has been 
(de)activated or that interception is taking place 

□ Protection of Target information 

> Protection of Rooms, Systems, Connections 

□ Local staff 

> Only authorised personnel may have knowledge that interception has 
been activated on a target 

> Unauthorised persons shall not be able to detect that any 
interception is active on certain subscribers 
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Requirements for Network Functions 

> Provision of lawful interception, with particular reference to the 
Handover Interface 

> To make available results of interception, related to specific identities 

> Functional role model and involved parties 

> Description of Handover Interfaces 

> Guidance on Performance and quality 

> Guidance on Security aspects 

> Guidance on Billing and Charging 



UtXfMigwt 
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\T [] LI Handover Interface (step 3) 

□ ETSI TS 101 671 (ETSI ES 201 671) 

Handover Interface for the Lawful Interception of 
Telecommunications Traffic 

> Generic flow of information and procedures and information 
elements, applicable to any future telecommunication network or 
service 

> Circuit switched and packet data 

> Covered technologies: 

PSTN, ISDN, GSM, UMTS (CS), GPRS, TETRA 
wireline NGN (including PSTN/ISDN emulation) 
wireline IMS PSTN simulation 

□ ETSI TR 102 053 

Notes on ISDN LI functionalities 

> Implementation advice of TS 101 671 for operators 
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Handover Interface ports (tsioi 67i) 



□ HI1 : for Administrative Information 

> Request for lawful interception: 

target identity, LflD, start/duration, IR1 or IRI+CC, 
IRI delivery address, CC delivery address, ... 

> Management information 



□ HI2: for delivery of Intercept Related Information 

> All data related to establish the telecommunication service and to 
control its progress 

> Correlation information 



□ HI3: for delivery of Content of Communication 

> Transparent en-clair copy of the communication 

> Correlation information 
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Handover Interface Concept (tsioi 67i) 



NWO/AP/SvP’s domain 



LEA 

domain 



HIl 



1 



HI2 



HI3 



II F : internal interception function 
INI: internal network interface 



LEMF 

LI handover interface HI 



HIl: administrative information 
HI2: intercept related information 
HI3: content of communication 



ISS World Bwuof* Track 3-4 June 2009, Prague; ETSI/TC LI activities on Retained Data and Lawful Interception 




Details on HI2 Interface (IRI) (TS 101 671) 



□ IRI data is defined according ASN.1 description 

> ITU-T Recommendation X.680 (Abstract Syntax Notation One) 



□ IRI Communication Associated Information 

> IRI-Begin 

• At first event of the communication attempt 

> IRI-Continue 

• Any time during the communication (attempt) 

> IRI-End 

• At the end of the communication (attempt) 

□ IRI Service Associated Information 

> IRI-Report 

• For any non-communication related events 
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□ LI related identities 

> LIID, target, network operator, network element, call ID, ... 

□ Timestamp 

□ Intercepted call direction (to / from target) 

□ Intercepted call state (in progress, connected) 

□ Address: Calling party /Called party/ Forwarded-to-party/.. 

> E.164, TEI, IMSI, IMEI, MSISDN, SIP URI, ... 

□ Ringing tone duration / conversation duration 

□ Type of intercept: 

> PSTN, ISDN, GSM (CS), TETRA, GPRS (PD), UMTS (CS) 

□ Supplementary service information 

□ Location information 

□ National parameters 

□ IRI record type (Begin, Continue, End, Report) 

□ .... 



T-l-fi . : 

i ti jv R l 

ISS World Eu'itfi Track 3-4 June 2009, Prague; ETSI/TC LI activities on Retained Data and Lawful Interception 



Interception network 
ISDN/PSTN Services 
step-by-step 
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IRI: Intercept Related Information 
CC Content of Communication 
INI: Internal Network Interface 
IIF: Internal Intercepting Function 
Al: Administrative Interface 



Management 
System 



Administration 

Function 1 



Mediation 
Function 2 




Mediation 
Function 3 




ISDI 



Mediator 
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Authorisation 
Authority / 
Law 
Enforcement 
Agency 



Law 

Enforcement 

Monitoring 

Facility 



HI2 

(IRI) 



HI 

(TS 10 



HI3 

(CC) 
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HI: Handover Interface 
HI1: Administration 
HI2: Intercept Related Information 
HI3: Content of Communication 
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Architecture Reports from TC LI 

□ ETSI TR 101 943 

Concepts of Interception in a Generic Network Architecture 

> High-level informative overview and principles regarding 
implementation of LI for telecommunications 

□ ETSI TR 102 528 

Interception domain Architecture for IP networks 

> High level reference architecture for supporting lawful interception 
for IP networks 

> High level description of Internal Network Functions and Interfaces 

> Application of the reference model to voice and multimedia over BP 
services, data layer 3 and layer 2 services 

> Reference model in the network operator and communication service 
provider (CSP) domain -> 

Tihjinu yn 
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Handover of LI via IP Networks (step 3) 



□ ETSI TS 102 232 part 01 (formerly TS 102 232) 

Delivery of IP based interception 

> General aspects of handover for HI2 and HI3 

(as defined by TS 101 671) where the underlying transport system is 
based on the Internet Protocol stack. 

> Modular approach used for specifying IP based handover interfaces 

> Header(s) to be added to IR1 and CC sent over the HI2 and HI3 
interfaces 

> Protocols for the transfer of IRI and CC across the handover 
interfaces 

> To be used in conjunction with other deliverables that define the 
service-specific IRI data formats 

> Protocol is defined according ASN.1 description 

ITU-T Recommendation X.680 (Abstract Syntax Notation One) 



UtXfMigwt 
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header information (ts 102 232-1 > 



□ Generic header information to be added to HI2 and HI3 traffic 

> LI1D 

> Authorization country code 

> Communication Identifier 

> Sequence number 

> Timestamp 

> Payload direction 

> Payload type 

> Interception Type 

> IR1 record type (Begin, Continue, End, Report) 

> ... 



T-l-fi » : 
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□ ETSI TS 102 232 part 02 (formerly TS 102 233) 

Service-specific details for E-Mail Services 

> Description for handover of E-mail messages; MTP, POP3, IMAP4 

□ ETSI TS 102 232 part 03 (formerly TS 102 234) 

Service-specific details for Internet Access Services 

> Handover of Internet Access Information and TCP/IP info; DHCP, RADIUS 

□ ETSI TS 102 232 part 04 (formerly TS 102 815) 

Service-specific details for Layer 2 Services 

□ ETSI TS 102 232 part 05 

Service-specific details for IP Multimedia Services 

> Based on SIP and RTP, and services described by ITU-T H.323, H.248 

□ ETSI TS 102 232 part 06 

Service-specific details for PSTN/ISDN Services 

□ ETSI TS 102 232 part 07 

Service-specific details for Mobile Services 
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Applications 
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TS 102 232 IP HO Family 
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SSD -> Service-Specific Details on top 



Generic Headers 



Handover manager 
Delivery session 

Transport layer 

Network layer 



Delivery network 



TS 102 232 part 01 



SSD 

for 

Mobile 

Services 



part 07 



ISS World Track 3-4 June 2009, Prague; ETSI/TC LI activities on Retained Data and Lawful Interception 




LI possibility on a VoIP platform 
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SIP 



rtp 



Interception 

Function 



HI 

TS 102 232-xx 



1) All SIP messages are copied over SPAN ports (or via 
mirrors) via the LI Switch to the Interception Function 

2) All rtp is copied to the LI Switch and if needed to the IF 







3) If needed rtp to be intercepted (local SBC traffic) is 
copied from the SBC to the Interception Function 
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ASN.1 Object Tree for LI 
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3GPP (UMTS) 

(3GPP TS 33.106) 



Lawful interception requirements 

> provides basic interception requirements 

> partly based on ETSI TS 101 331 



□ ETSI TS 133 107 (3GPP TS 33. 107) 

Lawful interception architecture and functions 

□ ETSI TS 133 108 (3GPP TS 33. 108) 

Handover interface for Lawful Interception 

A GLOBAL INITIATIVE 
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NGN Lawful Interception 



□ ETSI TS 187 005 (TC TISPAN) 

NGN Lawful Interception; Lawful Interception functional entities, 
information flow and reference points 
> Specification is developed in cooperation between 
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What’s next? 




□ Development of Dynamic Triggering and CCTF Standardisation 

> At the moment operators need tailor made integration to keep the 
complete service interceptable 

> There is a need for rules how the Network is performing Basic LI for 
BP related services 

> Also rules for triggering between networks are needed 

> International Dynamic Triggering might become an issue in the future 
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Relationships with other bodies 



□ 3GPP/SA3-LI 


(LI for UMTS & GSM) 


□ ETSI/EP TETRA 


(LI for Tetra system) 


□ ETSI/TC TISPAN 


(LI for fixed NGN & fixed IMS) 


□ ETSI/TC ATTM 


(LI for IPCableCom) 


□ ETSI/TC SES 


(LI for satellite systems) 


□ ETSI/TC PLT 


(LI for Powerline Communications) 


□ National and Regional Law Enforcement Agencies and STC/ILETS 


□ ATIS/PTCS LAES SC 

: 

1 !l -M .Ki 


(T1 .678 vl / J-STD-025-B) 
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More details on ETSI/TC LI can be found on: 

http://portal.etsi.org/li/Summary.asp 

Chairman TC LI: Peter@lawfulinterception.com 

Peter@DataRetention.eu 
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